CVE-2026-115905
Description
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
How to fix
- zip9.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zipcrates.io | v ≤ 9.0.4 | 9.0.5 |
| microsoft azl3_rust_1.98.1-1 | No range specified | — |
| microsoft azl3_rust_1.96.1-2 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.